Evanston Township High School ransomware closure

Analyst assessment

DysruptionHub assesses with high confidence that Evanston Township High School District 202 experienced a ransomware attack beginning June 7, 2026. The district’s rolling incident page confirms that the event disrupted district systems, internet services and computer infrastructure. DysruptionHub’s initial report and CBS News Chicago documented the immediate campus, communications and safety effects.

The district has not identified the access vector, ransomware family, compromised accounts, encryption scope or responsible actor. Ransomware is confirmed by the victim, but the technical and attribution picture remains limited.

Operational significance

The attack disrupted network connectivity, internet, phones, staff email and Google accounts, eSchool, Home Access Center, myETHS, door access, public-address functions and other emergency or operational systems. Because systems required for safe operations were unavailable, ETHS closed campus June 8–9 and canceled summer school, sports camps and other activities. Campus reopened June 10, but that did not mark full technology restoration.

In a July 16 school-year preparation statement, Superintendent Marcus Campbell said core servers had been inaccessible for about a month and that teams were rebuilding critical systems and restoring services. The district expected some tools, processes and timelines to function differently, with services returning in phases and temporary workarounds continuing into the school year.

The rolling incident page says Home Access Center and myETHS are no longer available, Home Access Center remains unavailable for grades, district phones remain down and staff access to systems and devices remains restricted during recovery. Student records are moving to Infinite Campus in phases. The incident interrupted transcript-data transfer, although the missing-grade issue was later corrected through Parchment.

The district’s student-parking page documents a delayed lottery, a replacement registration form, temporarily unavailable detailed account information and phone, email and in-person payment alternatives. These effects support records-processing disruption, service delay and alternate-channel use in addition to the previously documented outages and manual workarounds.

Current status

Recovery remained active as of August 3. The district’s live incident page continued to say response and restoration were ongoing, campus was operating with limited system functionality, students and families could not access some online resources, and teachers and staff had limited system access. The temporary parking workflow also extended through an August 3 second-round lottery, with permit pickup scheduled for August 6–7. No later full-restoration or all-clear notice was found.

Confidence and uncertainty

Confidence is high that ransomware caused material educational and safety-related disruption because the district directly confirmed the attack type and affected systems. Data availability was affected because core servers, records portals and some information workflows were inaccessible. Whether personal information was accessed, copied or removed remains unresolved; the district said forensic specialists were still examining that question.

CBS reported that the district had not received a money demand at the time of initial reporting. No later demand, payment, leak-site listing, data publication or actor attribution was found, so extortion details and attribution remain unresolved.

Analytic gaps

The public record does not identify the access vector, ransomware family, dwell time, persistence, affected endpoints or servers, encryption scope, backup impact, ransom amount, payment status or responsible actor. It also does not establish whether student, employee or other sensitive information was acquired, the full recovery cost, or when every affected system and workflow will be restored.